Malicious ZIP Archive analysis – 492125caa52f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

17.08 MB · 17,076,909 B

First seen

2026-08-27 19:15 · 2 months ago

Last seen

2026-08-27 19:15 · 2 months ago

Last analysis

2026-08-27 19:16 · 2 months ago

Hashes

MD5 e6f772f168e8db45fd160c44f00b0585 Sha1 95551c525f6e12f0ce8164a1e769805df522dee4 Sha256 492125caa52f8cba760dda3e1d099a264db9c4f10588514d144f258b49b22be1 Sha384 2fdeed01e5b9a12fb92abb8bf73c2afd51c2d3e2f4938fc36e267a78a9924792a513185202c42a77b6a5ec521a914d03 Sha512 a6cbd4f2f2d7a3e4ed095c6d769855e78c5df53094d97ff389cc87250c7da7eaf5cbf3ab293b10cdb98e15c24e5d92815733580206a36476d44f725b4f9f8a88 SSDeep 393216:+l8DnHr4O3iCe34ccaETyif3f8RC0Xydgt5qh/cTKGB0kmlp+S:G8DnH0Ove34cHfiklXF7qhSKGB0Rp+S TLSH 34072298D5FF5807CF1EBAFBB0C682859DECC7DA59205A26046C33CA5DA65B10BC520E

15 malicious · 2464 files

ZIPe6f772f168e8db45fd160c44f00b0585

BINbin

BINData

DLLDetectWave.dll

DLLFocus.dll

BINLang

BINlicenses

BINnode_modules

BINcorepack

MDCHANGELOG.md

BINdist

JScorepack.js

BINlib

PS1corepack.cjs

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

BIN[Base64-Block]

JSnpm.js

JSnpx.js

JSpnpm.js

JSpnpx.js

JSyarn.js

JSyarnpkg.js

MDLICENSE.md

JSONpackage.json

MDREADME.md

BINshims

BINnpm

BINbin

BINdocs

JSindex.js

BINlib

BINLICENSE

BINman

BINnode_modules

BIN@isaacs

BIN@npmcli

BIN@sigstore

BIN@tufjs

BINabbrev

BINagent-base

BINansi-regex

BINaproba

BINarchy

BINbin-links

BINbinary-extensions

BINcacache

BINchalk

BINchownr

BINci-info

BINcidr-regex

BINcli-columns

BINcmd-shim

BINcommon-ancestor-path

BINcssesc

BINdebug

BINdiff

BINemoji-regex

BINencoding

BINenv-paths

BINerr-code

BINexponential-backoff

BINfastest-levenshtein

BINfs-minipass

BINglob

BINgraceful-fs

BINhosted-git-info

BINhttp-cache-semantics

BINhttp-proxy-agent

BINhttps-proxy-agent

BINiconv-lite

BINignore-walk

BINimurmurhash

BINini

BINinit-package-json

BINip-address

BINip-regex

BINis-cidr

BINis-fullwidth-code-point

BINisexe

BINjson-parse-even-better-errors

BINjson-stringify-nice

BINjsonparse

BINjust-diff

BINjust-diff-apply

BINlibnpmaccess

BINlibnpmdiff

BINlibnpmexec

BINlibnpmfund

BINlibnpmorg

BINlibnpmpack

BINlibnpmpublish

BINlibnpmsearch

BINlibnpmteam

BINlibnpmversion

BINlru-cache

BINmake-fetch-happen

BINminimatch

BINminipass

BINminipass-collect

BINminipass-fetch

BINminipass-flush

BINminipass-pipeline

BINminipass-sized

BINminizlib

BINms

BINmute-stream

BINnegotiator

BINnode-gyp

JSON.release-please-manifest.json

GYPIaddon.gypi

BINbin

MDCHANGELOG.md

MDCODE_OF_CONDUCT.md

MDCONTRIBUTING.md

JSeslint.config.js

BINgyp

BINlib

JSbuild.js

JSclean.js

JSconfigure.js

JScreate-config-gypi.js

JSdownload.js

JSfind-node-directory.js

JSfind-python.js

PS1Find-VisualStudio.cs

PS1[Deobfuscated PS]

PS1find-visualstudio.js

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

JSinstall.js

JSlist.js

JSlog.js

JSnode-gyp.js

JSprocess-release.js

JSrebuild.js

JSremove.js

JSutil.js

BINLICENSE

SHmacOS_Catalina_acid_test.sh

JSONpackage.json

MDREADME.md

JSONrelease-please-config.json

MDSECURITY.md

BINsrc

BINnopt

BINnpm-audit-report

BINnpm-bundled

BINnpm-install-checks

BINnpm-normalize-package-bin

BINnpm-package-arg

BINnpm-packlist

BINnpm-pick-manifest

BINnpm-profile

BINnpm-registry-fetch

BINnpm-user-validate

BINp-map

BINpacote

BINparse-conflict-json

BINpath-scurry

BINpostcss-selector-parser

BINproc-log

BINproggy

BINpromise-all-reject-late

BINpromise-call-limit

BINpromise-retry

BINpromzard

BINqrcode-terminal

BINread

BINread-cmd-shim

BINretry

BINsafer-buffer

BINsemver

BINsignal-exit

BINsigstore

BINsmart-buffer

BINsocks

BINsocks-proxy-agent

BINspdx-correct

BINspdx-exceptions

BINspdx-expression-parse

BINspdx-license-ids

BINssri

BINstring-width

BINstrip-ansi

BINsupports-color

BINtar

BINtext-table

BINtiny-relative-date

BINtinyglobby

BINtreeverse

BINtuf-js

BINunique-filename

BINunique-slug

BINutil-deprecate

BINvalidate-npm-package-license

BINvalidate-npm-package-name

BINwalk-up-path

BINwhich

BINwrite-file-atomic

BINyallist

BINnpmrc

JSONpackage.json

MDREADME.md

DLLpython36.dll

BINSDK

EXESetuр.exe

DLLsvga3dsw.dll

DLLvcruntime140.dll

DLLzlib1.dll

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 3secondary ignored: 8

bin 5img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path arc:zip>scr:ps1~T1027~T1059.001

Shape arc:zip>scr:ps1

malicious 2 nodes

Path arc:zip>scr:ps1~T1059.001

Shape arc:zip>scr:ps1

technique2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

"use shuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential